Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-04T23:45:08 HdrHistogram: HdrHistogram: Local state issue via 'Count' argument manipulation 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CWE-1284

A vulnerability has been found in HdrHistogram up to 2.2.2. This vulnerability affects the function recordValueWithCount of the file src/main/java/org/HdrHistogram/AbstractHistogram.java of the component AbstractHistogram. Such manipulation of the argument Count leads to state issue. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

A flaw was found in HdrHistogram. A local attacker could exploit this vulnerability by manipulating the 'Count' argument within the `recordValueWithCount` function. This manipulation leads to a state issue, which could impact the integrity of data processing within the affected component.

This flaw in HdrHistogram is rated as Low impact. A local attacker could manipulate the 'Count' argument in the `recordValueWithCount` function, leading to a state issue that affects data integrity. Exploitation requires local access to the system where HdrHistogram is used. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-06-18T00:00:00Z RHSA-2026:26989 netavark-main-2.0.0-1.hum1 Red Hat Hardened Images 2026-07-02T00:00:00Z RHSA-2026:34975 rust-main-1.96.1-1.hum1 Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/vector-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/istio-ztunnel-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Enterprise Linux 8 Fix deferred HdrHistogram Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-llm-d-inference-scheduler-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-model-registry-job-async-upload-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Not affected conmon-rs Red Hat OpenShift Update Service Not affected openshift-update-service/openshift-update-service-rhel8 https://www.cve.org/CVERecord?id=CVE-2026-14685 https://nvd.nist.gov/vuln/detail/CVE-2026-14685 https://github.com/HdrHistogram/HdrHistogram/ https://github.com/HdrHistogram/HdrHistogram/issues/221 https://vuldb.com/cve/CVE-2026-14685 https://vuldb.com/submit/846761 https://vuldb.com/vuln/376281 https://vuldb.com/vuln/376281/cti